Commit Graph

24 Commits

Author SHA1 Message Date
Nan Liu 85350c6651
Update change logs to sync up with the ones in PMC (#6750) 2023-11-14 17:01:14 -08:00
Nan Liu 15bf461433
Fix golang CVE-2023-29409, CVE-2023-39318, CVE-2023-39319, CVE-2023-39323, CVE-2023-39533 (#6470) 2023-10-31 14:50:57 -07:00
Pawel Winogrodzki 01547eeed5
Fixed CVE-2023-44487 in `nginx` and `golang` (CP of #6381) (#6395)
* Fixed CVE-2023-44487 in `nginx` and `golang` (#6381)

Co-authored-by: Dan Streetman <ddstreet@ieee.org>
Co-authored-by: Pawel Winogrodzki <pawelwi@microsoft.com>

* Bumping 'kubernetes'.

---------

Co-authored-by: Dan Streetman <ddstreet@microsoft.com>
Co-authored-by: Dan Streetman <ddstreet@ieee.org>
2023-10-12 14:22:26 -07:00
Minghe Ren 044098bc0b
add patches for Glibc CVE-2023-4806 and CVE-2023-5156 (#6341)
* add patches for CVE

* bump dependency package release number

---------

Co-authored-by: minghe <rmhsawyer>
2023-10-06 14:55:34 -07:00
Mandeep Plaha 115ecc713d
Mandeepsplaha/patch cves against gdb (#6338)
* Patch CVE-2023-4911 in glibc
* Update all specs that build require glibc-static
2023-10-03 16:38:04 -07:00
Muhammad Falak R Wani e2ad74a2ca
Upgrade golang to 1.19.12 to address CVE-2023-29409 (#5946)
* golang: introduce patch to permit requests with invalid host headers

Reference: https://go-review.googlesource.com/c/go/+/518855
Signed-off-by: Muhammad Falak R Wani <falakreyaz@gmail.com>
2023-08-16 10:15:25 +05:30
Andrew Phelps 6d35fdd2fc
glibc: restore glibc-debuginfo package (#5795)
* update glibc so binaries are not stripped

* restore glibc-debuginfo
2023-07-14 16:20:19 -07:00
CBL-Mariner-Bot 78e1d24d47
Upgrade golang to 1.19.11 to fix CVE-2023-29406 (#5828) 2023-07-13 13:55:07 -07:00
CBL-Mariner-Bot c5a190f783
[AUTOPATCHER-CORE] Upgrade golang to 1.19.10 Address CVE-2023-24540, CVE-2023-29402, CVE-2023-29403, CVE-2023-29404, CVE-2023-29405 (#5689)
* Upgrade golang to 1.19.10 Adress CVEs

* Fix changelog

---------

Co-authored-by: Mitch Zhu <mitchzhu@microsoft.com>
2023-06-20 13:39:41 -07:00
Muhammad Falak R Wani a364e616af
golang: upgrade to 1.19.8 to address CVE-2023-24534, CVE-2023-24536, CVE-2023-24537, CVE-2023-24538 (#5228)
Reference: https://github.com/golang/go/issues?q=milestone%3AGo1.19.8+label%3ASecurity
Signed-off-by: Muhammad Falak R Wani <falakreyaz@gmail.com>
2023-04-05 21:38:04 +05:30
CBL-Mariner-Bot 42a2d6d72d
Upgrade golang to 1.19.7 to address CVE-2023-24532 (#5160)
Signed-off-by: Muhammad Falak R Wani <falakreyaz@gmail.com>
2023-03-28 13:20:34 +05:30
CBL-Mariner-Bot 768aae23e3
Upgrade golang to 1.19.6 Address CVE-2022-41722, CVE-2022-41724, CVE-2022-41725, CVE-2022-41723 (#5096)
Co-authored-by: Rakshaa Viswanathan <46165429+rakshaa2000@users.noreply.github.com>
2023-03-17 21:20:58 +05:30
CBL-Mariner-Bot 5ed28413bb
[AUTOPATCHER-CORE] Upgrade golang to 1.19.5 upgrade to latest - (#4759)
* Upgrade golang to 1.19.5 upgrade to latest

* remove release bump of spec that should stay on golang 1.18.8 or below
2023-02-03 20:56:43 +01:00
CBL-Mariner-Bot 63c1d45e66
[AUTOPATCHER-CORE] Upgrade golang to 1.19.4 upgrade to latest - (#4643)
* Upgrade golang to 1.19.4 upgrade to latest

* fix issues due to golang 1.19.4 upgrade

* re-add CVE-2022-41717.patch which is required by golang 1.17 spec

* clean up gh dependencies
2023-01-19 18:37:17 +01:00
Daniel McIlvaney 449fbf1b41
Patch golang to resolve CVE-2022-41717 (#4457)
* Patch golang to resolve CVE-2022-41717
2022-12-19 12:17:43 -08:00
Olivia Crain a828f488f8
Upgrade golang to 1.18.8 to fix CVE-2022-2879, CVE-2022-2880, CVE-2022-41715, CVE-2022-27664, CVE-2022-32190 (#4157) 2022-11-01 16:37:38 -07:00
Andy Caldwell 366add1699
Police `glibc-static` versions (#3748)
* Make `glibc-static` a real package and police its version

* Add version bounds to all mentions of `glibc-static` in spec files

* Bump releases for all affected packages

* Add pipeline job to check static glibc versions

* Release new glibc packages with split out glibc-static

* Include distribution in requirement bounds

* Don't implicitly install glibc-static in pkggen chroot

* Correctly split up the static libraries between devel/static

* Consistent use of f-strings

* Allow libacvp to build without depending on `glibc-static`

* Remove `libhugetlbfs-tests` package

* Update kernel configs to not support static linking

* Declare `glibc-static` dependency for flannel

* Enable `-pie` by default in `clang`

* Rebuild SymCrypt with `-pie` enabled `clang`

* Use `glibc-static` on all platforms for `busybox`

* Tidy up libacvp Source lines

* Clang can't default to `-pie` so move `crt1.o` to `glibc-devel`

* Fix libacvp Source0 syntax

* Don't build static binaries in libhugetlbfs-tests

* Update kernel config signatures

* Kubevirt needs glibc-static too
2022-10-12 16:30:40 +01:00
Olivia Crain fdc6619ad3
Bump supported go versions to 1.17.13, 1.18.5 to fix fifteen CVEs (#3600)
Co-authored-by: Pawel Winogrodzki <pawelwi@microsoft.com>
2022-08-24 09:01:02 -07:00
Muhammad Falak R Wani d76052103a
golang: bump version to 1.18.3 to address CVE-2022-24675 & CVE-2022-28327 (#3163)
* golang: rename specfile golang-1.17.spec -> golang.spec
* golang: bump version to 1.18.3 to address CVE-2022-24675 & CVE-2022-28327
* golang: bump release of dependent packages to force rebuild
* keda: verify license
* helm: verify license
* moby-containerd: bump version to 1.6.2 to address CVE-2022-24769
* golang: add go-1.17.10 to enable cert-manager
* cert-manger: add a hard BR on golang <= 1.17.10
* golang-17: add entry to cgimanifest

Signed-off-by: Muhammad Falak R Wani <falakreyaz@gmail.com>
2022-06-16 23:07:41 +05:30
Pawel Winogrodzki 77153f2702
[main] Removing redundant `%clean` stages from the spec files. (#1782) 2021-12-17 09:46:27 -08:00
Andrew Phelps ebbc32b6cc
Update golang to version 1.17.1 (#1404)
* update golang to 1.17.1

* linting

* update flannel and cri-tools versions

* typo

* provides go
2021-09-18 12:00:19 -07:00
jslobodzian 17b0e93e71
Merge 1.0 to dev branch
This merge brings the latest SELinux and many packages and CVE fixes from the 1.0 branch.
2021-08-19 13:46:51 -07:00
Pawel Winogrodzki e97bc19712
Fixing changelog entries and license mapping. (#586) 2021-02-02 11:57:13 -08:00
nicolas guibourge e5dc1d5f45
Update etcd versions and add coredns and flannel (#569)
* add coredns and flannel, move etcd to 3.4.3 and 3.4.13

* fix etcd build changes

* update cgmanifest

* address PR comments

Co-authored-by: Nicolas Guibourge <nicolasg@microsoft.com>
2021-02-01 09:44:01 -08:00